policy: add artifact attestation builtin support

Add artifact_attestation(http, filename) and wire verifier support for
artifact bundle checks. Add docker_github_builder_bundle helper rule.

Handle runtime unknown http.checksum after eval so metadata resolve is
requested when checksum is missing.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>

policy/utils_test.go

@@ -64,10 +64,11 @@ func TestRuntimeUnknownInputRefs(t *testing.T) {
 
 	st := &state{
 		Unknowns: map[string]struct{}{
-			funcVerifyGitSignature: {},
+			funcVerifyGitSignature:  {},
+			funcArtifactAttestation: {},
 		},
 	}
-	require.Equal(t, []string{"git.commit"}, runtimeUnknownInputRefs(st))
+	require.Equal(t, []string{"git.commit", "http.checksum"}, runtimeUnknownInputRefs(st))
 }
 
 func TestMissingInputRefsWithRuntimeUnknowns(t *testing.T) {